Summary
generated automatically from NVD dataYesWiki versions 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 have an unauthenticated SQL injection (CWE-89) in SearchManager::prepareSearchRequest(). Field names from the query and searchfields parameters of the public Bazar entries search API go into a backtick-quoted alias that is escaped only with mysqli_real_escape_string, so an attacker can use a backtick to inject subqueries. This can expose data such as user password hashes or tie up database threads through SLEEP(), and the flaw is rated CRITICAL with a CVSS v3.1 score of 9.1.
NVD description
YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unauthenticated SQL injection vulnerability in SearchManager::prepareSearchRequest(). Field names from the query and searchfields parameters of the public Bazar entries search API are placed in a backtick-quoted alias escaped only with mysqli_real_escape_string. Attackers can supply a backtick to inject subqueries, reading data such as user password hashes or exhausting database threads with SLEEP().
In-depth analysis on cveo.tech
We've published a detailed analysis of this CVE — exploitation, IOCs and mitigation.
CVSS v3.1 Score
Information
- Published
- 25 oct. 2026
- Updated
- 25 oct. 2026
- Status
- Deferred
- Source
- disclosure@vulncheck.com
Weaknesses (CWE)
Similar CVEs
Other vulnerabilities of type CWE-89
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.